Many Uber customers are reporting unauthorized rides paid through their accounts, the company excludes a data breach, but suggested a password reset.
In March, media agencies reported that the popular Uber service was hacked by cyber criminals, security experts discovered al least two different vendors offering stolen Uber customer logins in a black market on the Dark Web.
Now, something strange is happening to some American Uber customers that have been targeted by hackers. According to the claims of some Uber clients someone had access to their accounts and used them. The customers did the nasty discovery when received notification of unauthorized rides.
“It was crazy,” Stephanie Crisco told the MotherBoard. “I used Uber for the first time Thursday night. On Friday morning I received a notification on my phone that my driver was en route. I didn’t request a driver. I clicked on the notification and it said that the ride was cancelled but the pickup was in London.”
The girl also posted online an image related to the Twitter timeline that includes a number of canceled Uber rides that was apparently requested by her account, anyway she confirmed that the payments were made through her bank account. Crisco confirmed that Uber has refunded her for three rides, but to avoid further problems she removed her bank card since discovering the fraudulent payments.
There are various plausible hypothesis behind this incident, for example, it is possible that some other services were compromised by hackers and that they used shared the same credential with the Uber platform. This could be for example the case of the user Crisco that confirmed that she used the same credentials among various web services, including Uber. However, she wasn’t alone in reporting Uber account problems. Many other users have posted on Twitter, saying that their Uber accounts have been hijacked by unknown individuals who took rides using their accounts.
Unfortunately, Crisco wasn’t the unique Uber customer to have a similar problem, other users have posted on Twitter claiming their Uber accounts have been hijacked, also in these cases the hackers paid rides using their accounts.
Uber confirmed to Motherboard that its experts haven’t found any evidence of a data breach.
“We do not have any additional information to share beyond the statement we provided before: We investigated and found no evidence of a breach,” an Uber spokesperson said. “Attempting to fraudulently access or sell accounts is illegal and we notified the authorities about this report. This is a good opportunity to remind people to use strong and unique usernames and passwords and to avoid reusing the same credentials across multiple sites and services.”
Waiting for more details of ongoing investigation, I strongly suggest Uber user to change their password, as also suggested by the company.
Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer.
Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US.
Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines.
Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.